The vulnerability arises from the net_dhcpv4_msg_type_name() function in Zephyr's DHCPv4 client, which uses a faulty bounds check to index an 8-element static array of message type names. The check incorrectly uses sizeof(name) instead of ARRAY_SIZE(name), allowing message-type values between 9 and the byte size of the array pointer (32 or 64) to pass and cause out-of-bounds reads. The msg_type value is derived directly from unvalidated DHCP MESSAGE TYPE option bytes from received packets. This out-of-bounds read occurs only when DHCPv4 debug logging is enabled (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG). The consequence is a wild pointer dereference during a %s log conversion, likely causing a DHCP client crash (denial of service) and possible leakage of adjacent memory contents in logs. The fix involves replacing sizeof with ARRAY_SIZE to enforce correct bounds checking.

An attacker capable of injecting spoofed DHCP replies on the client's network link can trigger an out-of-bounds read in the DHCPv4 client when debug logging is enabled. This leads to a wild pointer dereference causing a likely crash of the DHCP client, resulting in denial of service. Additionally, there is potential for information disclosure through log output of adjacent memory contents. The vulnerability does not impact confidentiality or integrity beyond this limited disclosure and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, the vulnerability can be mitigated by ensuring that DHCPv4 debug logging is not enabled (i.e., do not set CONFIG_NET_DHCPV4_LOG_LEVEL_DBG to DEBUG). Disabling or lowering the DHCPv4 log level prevents the vulnerable code path from being executed. Monitor the Zephyr project advisories for an official fix that corrects the bounds check from sizeof to ARRAY_SIZE.